Recent findings from the US-based cybersecurity firm, Volexity, reveal alarming cyberattack campaigns targeting Tibetans, Uyghurs, and the Taiwanese communities. The detailed report underscores the discreet implantation of malware within legitimate mobile applications, granting hackers clandestine access to the victims’ devices.
Attributed to the threat actor EvilBamboo, previously known as Evil Eye, these cyber operations have reportedly been in the interests of the Chinese state. This group is deploying malware types named BADSIGNAL, BADBAZAAR, and BADSOLAR. Apart from basic device data, this malware can access users’ Ethereum accounts via the MetaMask browser extension and even fingerprint browsers.
Volexity‘s report, cited by Cybernews, has identified an array of fake websites devised to distribute this malware. These include signalplus.org, allwhatsapp.net, flygram.org, groupgram.org, ignitetibet.net, uyghurinfo.net, and tw.tinmf.org. These websites, while appearing genuine, often camouflage themselves with content related to Taiwan‘s independence and, in some cases, leverage custom JavaScript profiling frameworks.
ALSO READ: Erosion of Tibetan Culture Amidst Increasing Assimilation Pressures from China
Furthermore, the cyber attackers have expanded their reach to social media, creating impostor profiles on platforms to distribute malicious content. Notably, Telegram groups “Tibetanmaptalk” and “Tibetanphone” have been found disseminating malware-embedded applications. “Since 2020, we’ve tracked EvilBamboo’s persistent focus on the Tibetan community, deploying Android spyware. Over 120 compromised Android Package Kits have been shared via such groups,” a Volexity researcher shared.
One of the most concerning aspects is the hackers’ precision in targeting individuals who communicate in lesser-supported languages, such as Tibetan or Uyghur. For instance, one malicious post found on “Tibetanmaptalk” Telegram channel sought a Tibetan translation of the backdoored AlpineQuest map software.
As the digital landscape evolves, so do the threats. Experts from the cybersecurity domain are urging individuals to exercise caution, emphasizing the importance of downloading apps solely from verified sources, and remaining skeptical of unsolicited communications.
About Post Author
